Why Does My WordPress Site Keep Getting Hacked?

The short version

A site that gets hacked again a week or a month after it was "cleaned" almost always has one of two problems. Either the cleanup removed what was visible and missed the hidden way back in, or it removed the infection but left open whatever let the attacker in to begin with. Sometimes both. It is rarely bad luck, and it is almost never personal: the same bots that found your site the first time still have it on their list.

The usual reasons

A backdoor was left behind. When an attacker gets into a site, the first thing most of them do is plant a small hidden file, or a line of code inside a real file, that lets them back in later without a password. A cleanup that deletes the spam pages and the obvious malware, but not the backdoor, is undone the next time the attacker's script runs. This is the most common reason a site is reinfected within days.

The hole is still open. The way in is usually a plugin or theme with a known security hole, running an old version. If the cleanup didn't update or remove it, the same hole is used again. Thousands of bots scan for exactly these versions around the clock.

Passwords were never changed. If the attacker got in with a guessed or stolen password, and that password is still in use, they simply log back in. The same goes for the hosting account, the database password, and any other admin users on the site.

An admin account you didn't create is still there. Attackers add their own administrator account so they keep access even after passwords change. It's easy to miss, and some are hidden from the Users list.

A clean site sits next to an infected one. If several sites share one hosting account, an infected one can reinfect the others. An old test copy or an abandoned site in the same account is a frequent culprit.

You restored an infected backup. A backup taken after the break-in has the malware in it. Restore it and the hack comes back, sometimes within minutes, because the backdoor is restored with it.

What actually stops it

A cleanup that sticks has to do all of these, not some of them: remove every copy of the malware and every backdoor, check for and remove unknown accounts, update or remove whatever had the security hole, change every password and secret key, and check the other sites in the same account. Then the site needs to stay updated, because the next security hole will be found in some plugin eventually, and the bots will come looking again.

That last part is why repeat hacks and maintenance go together. Every Warrior WP care plan includes weekly plugin and theme updates tested on a copy first, daily checks against known security holes, and daily backups, so the hole gets closed before the bots find it. Here's what a care plan includes and what fixing a hacked site costs.

If it's happening right now

Change your WordPress and hosting passwords, note when the signs came back, and don't restore a backup until you know the date it was clean. Then get the site cleaned properly, once. Our Hacked Site Cleanup covers the backdoors, the accounts and the hole that let them in, at a flat rate you approve before any work starts.